sublimemediumRule

Attachment: Malicious mobileconfig profile

Detects inbound emails containing .mobileconfig attachments that either reference a known malicious profile UUID string within their parsed text or match a list of known malicious SHA256 hashes. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598

initial-access

Detection Query

type.inbound
and any(attachments,
        .file_extension == "mobileconfig"
        and (
          strings.icontains(file.parse_text(.).text,
                            '10a30957-e16b-30bf-c00f-48e1e9a85069'
          )
          or .sha256 in (
            '783cdb7425fbc29f5e35801d38a4782040da7f50e74d78de4b56eaa532eda82a',
            'ee8f15128560c2b2b4ee242026b2a2880ee604fe8489abb999ac43c969cfcdce',
            '8c0013f6ee4fe229f567469ed3f1bdaf2ee6a7a4b39a04ed28df38fa25287dfb'
          )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Malicious mobileconfig profile"
description: "Detects inbound emails containing .mobileconfig attachments that either reference a known malicious profile UUID string within their parsed text or match a list of known malicious SHA256 hashes. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains."
type: "rule"
severity: "medium"
source: |
    type.inbound
    and any(attachments,
            .file_extension == "mobileconfig"
            and (
              strings.icontains(file.parse_text(.).text,
                                '10a30957-e16b-30bf-c00f-48e1e9a85069'
              )
              or .sha256 in (
                '783cdb7425fbc29f5e35801d38a4782040da7f50e74d78de4b56eaa532eda82a',
                'ee8f15128560c2b2b4ee242026b2a2880ee604fe8489abb999ac43c969cfcdce',
                '8c0013f6ee4fe229f567469ed3f1bdaf2ee6a7a4b39a04ed28df38fa25287dfb'
              )
            )
    )
  
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "File analysis"
  - "Content analysis"
  - "Threat intelligence"
id: "447bce8d-dc96-5110-9aeb-9434fcffc717"